How to Test GitHub Webhooks

GitHub webhooks notify your server when certain events happen in a repository, organization, or GitHub App.

Looking for the broader picture? See the 7 best webhook testing tools (2026), or if you're already on Webhook.site, the 60-second migration to HookRay.

1. GitHub Webhook Events

GitHub can send the following webhook events to your endpoint:

2. Set Up a Test Endpoint with HookRay

Follow these steps to start receiving GitHub webhooks for testing:

1. Go to HookRay and click "Start Testing — Free" to get your unique webhook URL.
2. Copy the URL (e.g., https://h.hookray.com/abc123).
3. In your GitHub dashboard, navigate to the webhook settings and paste the HookRay URL as your endpoint.
4. Select the events you want to receive (see list above).
5. Trigger a test event — HookRay will show the incoming webhook in real-time.

3. Sample GitHub Webhook Payload

Here's an example of what a GitHub webhook payload looks like:

{
  "action": "opened",
  "pull_request": {
    "number": 42,
    "title": "Fix authentication bug",
    "user": {
      "login": "developer"
    },
    "head": {
      "ref": "fix/auth-bug"
    },
    "base": {
      "ref": "main"
    }
  },
  "repository": {
    "full_name": "org/repo"
  }
}

4. How to Verify GitHub Webhook Signatures

Node.js (Express)

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post(
  '/webhooks/github',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-hub-signature-256'] as string | undefined;
    if (!signature) return res.status(401).send('missing signature');

    const expected =
      'sha256=' +
      crypto
        .createHmac('sha256', process.env.GITHUB_WEBHOOK_SECRET!)
        .update(req.body) // raw Buffer
        .digest('hex');

    const sigBuf = Buffer.from(signature);
    const expBuf = Buffer.from(expected);
    if (
      sigBuf.length !== expBuf.length ||
      !crypto.timingSafeEqual(sigBuf, expBuf)
    ) {
      return res.status(401).send('invalid signature');
    }

    // Trusted: parse JSON ourselves now that the body is verified.
    const event = JSON.parse(req.body.toString('utf8'));
    res.json({ ok: true, action: event.action });
  },
);

Python (FastAPI)

import hmac, hashlib, os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.post("/webhooks/github")
async def github_webhook(request: Request):
    body = await request.body()
    signature = request.headers.get('x-hub-signature-256', '')
    expected = 'sha256=' + hmac.new(
        os.environ['GITHUB_WEBHOOK_SECRET'].encode(),
        msg=body,
        digestmod=hashlib.sha256,
    ).hexdigest()
    if not hmac.compare_digest(signature, expected):
        raise HTTPException(status_code=401, detail='invalid signature')
    return {'ok': True}

Capture a real GitHub webhook with HookRay first, then replay the captured request against your verifier locally — that way you can iterate on the verification code without re-triggering events in GitHub. Read GitHub's official signing docs for the canonical reference, or see the cross-service signature verification guide for Ruby and timing-safe comparison patterns.

5. How GitHub Retries Failed Webhooks

If your handler is going to see the same GitHub event multiple times, you need idempotency by event ID and the right response codes — see the Webhook Retry Strategies guide for the full pattern (idempotency tables, dead-letter queues, replaying captured events for tests). Cross-reference with GitHub's official retry docs before relying on these numbers in production.

6. Frequently Asked Questions

7. Next Steps

• Use HookRay's webhook replay feature to re-send captured webhooks while building your handler
• Enable smart parsing (Pro plan) to see GitHub-specific fields highlighted automatically
• Check the GitHub webhook documentation for the complete event reference